How to generate a custom report for attacks on Cisco Secure-Monitoring Analysis and Response System (CS-MARS)

[TCC_2]

Resolution

Complete these steps to create a custome report for attacks on CS-MARS:

1. Go to the Query Page and choose Attacks > All > Top Destinations (Total View).
   
   
2. In the page that appears, click on Query Type: Destination IPs Ranked By Sessions (or click on the white [Edit] button in the green box).
   
   
3. In the Result Format box, choose All Matching Sessions, Customer Columns.
   
   
4. Choose the columns that you want to appear in the report. Make sure Reporting Device is the last column.
   
   
5. In Filter by Time, choose the option you want.
   
   
6. Click Apply.
   
   
7. Click Save As Report.
   
   
8. Give the report a name and description.
   
   
9. Click Next.

Note: You can also add/remove event types from the Query if you need to.

For additional help on CS-MARS, refer  Administering the MARS appliance 

For details  of all versions, refer to the CS-MARS release notes.